Fix a crash caused by changing dir attribute of a slot element

third_party/WebKit/Source/core/html/HTMLElement.cpp

Index: third_party/WebKit/Source/core/html/HTMLElement.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLElement.cpp b/third_party/WebKit/Source/core/html/HTMLElement.cpp
index c65115f04480fb2aae2393bbd052934002cd2aa6..4c111901082e2e9a51685be609f01ed2c50b584f 100644
--- a/third_party/WebKit/Source/core/html/HTMLElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLElement.cpp
@@ -777,6 +777,8 @@ void HTMLElement::dirAttributeChanged(const AtomicString& value)
 {
     // If an ancestor has dir=auto, and this node has the first character,
     // changes to dir attribute may affect the ancestor.
+    if (!canParticipateInFlatTree())
+        return;

[kochi, 2016/07/22 07:41:33]

nit: The comment above and these 2 lines are not related, maybe swap
778-779 and 780-781?

[hayato, 2016/07/22 09:59:36]

Ah. Thanks, but I did not think so. I thought that this comment is applied to
all of this function.
Let me leave this as is.

     updateDistribution();
     Element* parent = FlatTreeTraversal::parentElement(*this);
     if (parent && parent->isHTMLElement() && toHTMLElement(parent)->selfOrAncestorHasDirAutoAttribute())